Privacy Policy
United Kingdom Privacy Addendum (UK GDPR)
This addendum supplements the eGifter Global Privacy Policy and applies to residents of the United Kingdom. It is provided in accordance with the UK General Data Protection Regulation ("UK GDPR") as retained in UK law by the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 ("DPA 2018").
This addendum should be read together with the eGifter Global Privacy Policy, which describes our general data practices, categories of personal information, and sources of data.
Last Updated: July 9, 2026
A. Data Controller Information
I. Data Controller
GroupGifting.com, Inc. d/b/a eGifter, 315 Main Street, 2nd Floor, Huntington, NY 11743, USA, is the data controller for personal data processed in connection with the eGifter gift card platform and storefront services.
For data protection enquiries: privacy@egifter.com
II. Data Protection Contact
eGifter has designated a data protection contact responsible for overseeing UK GDPR compliance. To exercise your data subject rights or raise a data protection concern, contact: privacy@egifter.com with the subject line "UK GDPR Data Subject Request."
III. Relationship Between eGifter and Merchants
When you purchase a gift card directly from eGifter through an eGifter-operated storefront, eGifter processes your personal data in connection with providing the Services and acts as a data controller for those processing activities under the UK GDPR.
When you purchase a gift card through a merchant-branded storefront powered by eGifter, both eGifter and the applicable merchant generally process personal data. The respective roles and responsibilities of each party depend on the context of the transaction, the services provided, and applicable law. In many circumstances, eGifter and the merchant act as independent controllers with respect to their own processing activities. In limited circumstances, such as shared fraud prevention, security monitoring, or compliance-related activities, eGifter and the merchant may be considered joint controllers for specific processing activities as required under the UK GDPR.
B. Your Rights as a Data Subject
As a UK resident, you have the following rights under the UK GDPR and DPA 2018, subject to applicable conditions and exceptions:
| Right | Description |
|---|---|
| Right of Access (Art. 15) | Obtain confirmation of whether we process your personal data and receive a copy. |
| Right to Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data. |
| Right to Erasure (Art. 17) | Request deletion of your personal data in certain circumstances. |
| Right to Restriction (Art. 18) | Request restricted processing in certain circumstances. |
| Right to Data Portability (Art. 20) | Receive your personal data in a structured, machine-readable format. |
| Right to Object (Art. 21) | Object at any time to processing based on legitimate interests on grounds relating to your particular situation, and object at any time and without justification to processing for direct marketing purposes (including profiling related to direct marketing). |
| Right to Withdraw Consent (Art. 7(3)) | Withdraw consent at any time without affecting prior lawful processing. |
| Rights Related to Automated Decision-Making (Art. 22) | Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to exceptions. |
| Right to Lodge a Complaint (Art. 77) | Lodge a complaint with the Information Commissioner's Office (ICO). |
To exercise any of these rights, please contact privacy@egifter.com. We will respond to verified data subject requests within the timeframe required by applicable law.
C. Legal Bases and Processing Activities
We process personal data on the legal bases permitted under Article 6 UK GDPR, including where processing is necessary to perform a contract with you, to comply with legal obligations, to protect our legitimate interests (such as fraud prevention and platform security), or where you have provided consent. More information about our processing activities, categories of data, and retention criteria is described in the eGifter Global Privacy Policy.
D. International Data Transfers
Your personal data may be transferred to and processed in jurisdictions outside the United Kingdom, including the United States and other countries where our service providers or merchant partners are located.
Where personal data is transferred outside the United Kingdom to countries that may not provide an equivalent level of data protection, we implement appropriate safeguards in accordance with UK data protection law to ensure that personal data remains protected.
E. Cookies and PECR
In accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) as amended, we obtain your consent before placing non-essential cookies on your device. Cookies are categorised as follows:
| Category | Purpose | Legal Basis | Consent Required |
|---|---|---|---|
| Necessary | Essential platform functionality and security | Legitimate interests (Art. 6(1)(f)) | No |
| Functional | Preferences, language and currency settings | Consent under PECR | Yes |
| Analytics | Understanding platform usage | Consent under PECR | Yes |
| Marketing | Targeted advertising and retargeting | Consent under PECR | Yes |
F. Automated Decision-Making
We use automated processing to support fraud prevention and transaction security, including where necessary to perform a contract with you. Where required by applicable law and where automated decision-making produces legal or similarly significant effects, you may have rights related to such processing and applicable safeguards.
To exercise these rights, contact privacy@egifter.com. We will respond within the timeframe required by applicable law.
G. Data Security
We maintain appropriate technical and organizational measures designed to protect personal data against unauthorized access, use, or disclosure. Despite these safeguards, no system is completely secure.
H. Supervisory Authority
You have the right to lodge a complaint with the UK data protection supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
I. Contact
For all UK GDPR-related enquiries:
Email: privacy@egifter.com
Subject line: "UK GDPR Data Subject Request" or "UK GDPR Enquiry"